When using XML-RPC with HTTP Basic Authentication, why isn XWT sending an Authenticate header?
Many XML-RPC server implementations have a broken implementation of Basic Authentication. XML-RPC runs over HTTP. Authentication is handled at the HTTP layer. The HTTP spec clearly states that a server MUST return a 401 Unauthorized when a client requests a resource which requires authorization, yet has not presented a valid Authorization header. Many XML-RPC servers fail to return a 401, instead returning a 200 with a fault. The client needs the 401 (and enclosed WWW-Authenticate header) in order to know the authentication realm, authentication type, and digest nonce it should use while authenticating. Without this information, secure authentication is impossible. A client cannot assume Basic authentication, since that would cause it to send the user’s password in the clear even when communicating with Digest-capable servers — a massive security hole. The following XML-RPC server libraries are known to have this flaw: • The Apache XML-RPC libraries. The Apache developers were notifie
